Errors & Rate Limits
Every status code the API returns and what it means.
Every error response is JSON with an error field describing what went wrong. Some carry extra
fields your integration can act on directly.
| Status | Meaning | Extra fields |
|---|---|---|
| 400 | Malformed request — bad URL, invalid depth, invalid failOn. | — |
| 401 | Missing or malformed Authorization header, or an invalid/revoked API key. | — |
| 402 | Out of scan credit or subscription seat. | checkoutHint: link to upgrade. |
| 403 | Plan doesn't include API access, or the domain isn't authorized yet. | needsOwnership: true when it's the ownership gate specifically. |
| 404 | The scan doesn't exist, or belongs to a different organization than your key. | — |
| 429 | Rate limit — per-key (60/min) or the org's scan-concurrency/scans-per-hour caps. | retry-after header (seconds). |
Rate limits
- 60 requests/minute per API key, across every endpoint.
- Scan concurrency and scans-per-hour caps are shared with every other way of starting a scan (dashboard, API, monitor) — an API key doesn't get its own separate budget.
A 404 is deliberate, not a bug
Requesting a scan that belongs to another organization returns the same 404 as a scan that
never existed — never a 403 that would confirm the id is real. If you're debugging a
cross-account issue, double-check which API key you're using before assuming the scan is gone.